ADTRADE-005: Entra Seamless SSO Computer Account (AZUREADSSOACC$) Key Rotation
- Plataforma
- Active Directory
- Categoría
- AD Adversary Tradecraft Indicators
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
When Entra (Azure AD) Seamless Single Sign-On is enabled for hybrid identity, AD creates a computer account named AZUREADSSOACC$. Its password is the shared Kerberos key Entra uses to validate SSO tickets. Microsoft documents that this key is NOT rotated automatically — administrators must roll it. If an attacker extracts the AZUREADSSOACC$ key (it is a normal NT hash readable via DCSync or from a DC), they can forge Kerberos Silver Tickets for the Azure AD service and authenticate as ANY synchronized hybrid user, with no further interaction, for as long as the key remains valid. A key that has not been rotated in over 90 days dramatically widens that window.
Valor recomendado
AZUREADSSOACC$ Kerberos key rotated at least every 90 days (roll it twice per rotation to invalidate the previous key).
Remediación
Rotate the Seamless SSO key on a machine with the Entra Connect / Azure AD module: Import-Module 'C:\Program Files\Microsoft Azure Active Directory Connect\AzureADSSO.psd1'; New-AzureADSSOAuthenticationContext; Update-AzureADSSOForest. Perform the rotation twice (the account stores current + previous key) and schedule it on a recurring basis. If Seamless SSO is no longer used, disable it and delete the AZUREADSSOACC$ object.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5, AC-6
- ANSSI
- vuln1_azureadssoacc_pwd_change
- CIS AD Benchmark
- 6.1.1
- MITRE ATT&CK
- T1558.002, T1550.003